Rush has submitted this change and it was merged.
Change subject: diamond: Let diamond read the puppet state file (take 2)
......................................................................
diamond: Let diamond read the puppet state file (take 2)
This reverts commit 07bc23c866fb90c712bffaff7564b8ca960f7708,
and also adds a few fixes to prevent spam from happening again.
The spam was because of an older version cherry-picked on
to betacluster, which has been fixed by bd808.
Agent now first checks if it can sudo before attempting
to do so. Such sudo failures will be logged to diamond.log.
Change-Id: Ia2fc78fadbfa9dbc036d9dfb210e8e0db222fe62
---
M modules/diamond/files/collector/minimalpuppetagent.py
M modules/diamond/manifests/collector/minimalpuppetagent.pp
2 files changed, 34 insertions(+), 9 deletions(-)
Approvals:
Rush: Verified; Looks good to me, approved
jenkins-bot: Verified
diff --git a/modules/diamond/files/collector/minimalpuppetagent.py
b/modules/diamond/files/collector/minimalpuppetagent.py
index 65ac61f..11e4e13 100644
--- a/modules/diamond/files/collector/minimalpuppetagent.py
+++ b/modules/diamond/files/collector/minimalpuppetagent.py
@@ -9,6 +9,8 @@
Adapted from PuppetAgentCollector
+Requires the ability to sudo as puppet to be able to collect.
+
#### Dependencies
* yaml
@@ -16,6 +18,7 @@
"""
import time
+import subprocess
try:
import yaml
yaml # workaround for pyflakes issue #13
@@ -32,6 +35,7 @@
self).get_default_config_help()
config_help.update({
'yaml_path': "Path to last_run_summary.yaml",
+ 'sudo_user': "The user to sudo as to read the file at yaml_path"
})
return config_help
@@ -42,18 +46,30 @@
config = super(MinimalPuppetAgentCollector, self).get_default_config()
config.update({
'yaml_path': '/var/lib/puppet/state/last_run_summary.yaml',
+ 'sudo_user': 'puppet',
'path': 'puppetagent',
'method': 'Threaded',
})
return config
- def _get_summary(self):
- summary_fp = open(self.config['yaml_path'], 'r')
+ def _check_sudo(self):
+ """Check if diamond can sudo as puppet to read the summary file"""
+ check_path = ['/usr/bin/sudo', '-l', '-u', self.config['sudo_user'],
+ '/bin/cat', self.config['yaml_path']
+ ]
+ proc = subprocess.Popen(check_path, stdout=subprocess.PIPE)
+ out, _ = proc.communicate()
+ return out.strip() == '/bin/cat %s' % self.config['yaml_path']
- try:
- summary = yaml.load(summary_fp)
- finally:
- summary_fp.close()
+ def _get_summary(self):
+
+ process_path = ['/usr/bin/sudo', '-u', self.config['sudo_user'],
+ '/bin/cat', self.config['yaml_path']
+ ]
+ proc = subprocess.Popen(process_path, stdout=subprocess.PIPE)
+ out, _ = proc.communicate()
+
+ summary = yaml.load(out)
return summary
@@ -62,6 +78,9 @@
self.log.error('Unable to import yaml')
return
+ if not self._check_sudo():
+ self.log.error("diamond can't sudo as puppet to read summary file")
+ return
summary = self._get_summary()
# Only publish total executed time and 'time since last puppet run'
diff --git a/modules/diamond/manifests/collector/minimalpuppetagent.pp
b/modules/diamond/manifests/collector/minimalpuppetagent.pp
index 0300d75..09c74cb 100644
--- a/modules/diamond/manifests/collector/minimalpuppetagent.pp
+++ b/modules/diamond/manifests/collector/minimalpuppetagent.pp
@@ -4,12 +4,18 @@
# that collects just time since last puppet run
# and total time it took for puppet to run
#
-# Note: Requires puppet 3+ since older puppet did
-# not make the required summary yaml file world readable
-#
define diamond::collector::minimalpuppetagent {
ensure_packages(['python-yaml'])
+ # Diamond user needs sudo to access last_run_summary.yaml file generated by
+ # puppet, since /var/lib/puppet doesn't have +x set
+ admin::sudo { 'diamond_sudo_for_puppet':
+ user => 'diamond',
+ comment => "diamond needs sudo to access puppet's
last_run_summary.yaml file",
+ privs => ['ALL=(puppet) NOPASSWD: /bin/cat
/var/lib/puppet/state/last_run_summary.yaml']
+ }
+
+
diamond::collector { 'MinimalPuppetAgent':
source => 'puppet:///modules/diamond/collector/minimalpuppetagent.py',
require => Package['python-yaml'],
--
To view, visit https://gerrit.wikimedia.org/r/144463
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: Ia2fc78fadbfa9dbc036d9dfb210e8e0db222fe62
Gerrit-PatchSet: 9
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Yuvipanda <[email protected]>
Gerrit-Reviewer: Rush <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
